A method and chip for implementing Mifare One card functionality based on Flash devices

Abstract

The application discloses a method and a chip for realizing Mifare One card function based on a Flash device. The method allocates 16 pages or 32 pages of continuous space in the Flash, uniformly divides the space into 16 sectors, each sector occupies 2 pages and is initialized as a default value. After the device is powered on, standby is waited and a card reader command is waited. When an authentication command is received, double condition validity verification is performed by checking magic word marks and dynamic check values: if double pages are valid, a page with a larger count value is selected as a latest page, if a single page is valid, the page is directly selected, if both double pages are invalid, an error is reported. When a read command or a write command is processed, it is necessary to verify whether a current data block number and a data block number in the authentication command are in a same sector, and the authentication must be finally successful, otherwise a NACK response is returned; after verification, corresponding read / write operation can be executed. Thus, the function of the Mifare One card is realized by using the Flash without EEPROM.

Description

Technical Field

[0001] This invention relates to a method for implementing Mifare One card functionality based on a Flash device, and also to a corresponding Mifare One card functional chip, belonging to the field of integrated circuit technology. Background Technology

[0002] The Mifare One card (M1 card for short) is the mifare classic EV1 contactless smart card developed by NXP. It features 1KB of memory and is widely used in transportation cards, ticketing systems, access control, and other applications. The card has a built-in 1KB dedicated EEPROM memory, divided into 16 sectors, each containing 4 blocks, with each block having a capacity of 16 bytes. Each block has independent access control functionality. Furthermore, NXP has specified the command set supported by the M1 card's communication protocol and its stringent response time requirements.

[0003] However, in some hardware platforms, due to the lack of external EEPROM or the inability to expand EEPROM, it is still necessary to implement the functions of a standard M1 card (or even to simulate multiple M1 cards simultaneously). Therefore, it is necessary to fully simulate the original 1KB storage structure and functions of the EEPROM using Flash memory. Such requirements are commonly seen in the following typical scenarios: (1) Many 32-bit MCUs (such as STM32, GD32, ESP32, NRF52 series) only integrate Flash memory, while the on-chip EEPROM resources are lacking or have very small capacity. If you want to implement the "M1 card emulation" function on such devices (such as mobile phone NFC, Bluetooth access control, vehicle keyless entry and other systems), you must use the on-chip Flash to simulate the behavior of the 1KB EEPROM in the M1 card.

[0004] (2) Some security chips store sensitive data in Flash (with encryption and wear leveling mechanisms) instead of using independent EEPROM in order to reduce chip area and power consumption.

[0005] (3) For example, Android phones do not have EEPROM hardware. If an M1 card needs to be temporarily simulated, the application layer usually stores the card data in the file system or Flash partition and loads it dynamically when needed. Similarly, the access control system needs to send the new M1 card data to the terminal device through the network. If the terminal does not have a physical EEPROM, it must rely on Flash to realize the simulation and dynamic switching of multiple cards.

[0006] Therefore, the industry urgently needs an effective method to accurately simulate the memory structure of the Mifare One card in a hardware environment without EEPROM, using Flash memory and its driver characteristics, and to meet the functional and real-time performance requirements of various commands of the M1 protocol. Summary of the Invention

[0007] The primary technical problem to be solved by this invention is to provide a method for implementing the Mifare One card function based on a Flash device.

[0008] Another technical problem to be solved by the present invention is to provide a corresponding Mifare One card function chip.

[0009] To achieve the above-mentioned technical objectives, the present invention adopts the following technical solution: According to a first aspect of the present invention, a method for implementing Mifare One card functionality based on a Flash device is provided, comprising the following steps: S1: Allocate 16 or 32 consecutive pages of space in the Flash area; S2: Divide the Flash area into 16 parts, each part corresponding to 1 sector of the Mifare One card, and each part consists of 2 Flash pages, referred to as page 1 and page 2 respectively; S3: Initialize each section to the default value of the Mifare One card sector; S4: After power-on, it enters the receiving state and waits for the card reader command; S5: If the chip receives an authentication command from the reader, check the magic letter flag and dynamic check value of each page, and verify the data validity under two conditions: when both pages are valid, select the page with the larger count value as the latest page; when only one page is valid, directly select the correct page as the latest page; if both pages are invalid, report an error. S6: If the chip receives a read command from the card reader, it retrieves the data block number parameter from the read command and determines whether the data block number parameter in the read command and the data block number parameter in the authentication command are in the same sector, or whether the authentication command ultimately failed. If they are not in the same sector or the execution fails, the chip replies with a NACK response to the card reader; otherwise, it executes the read command steps. S7: If the chip receives a write command from the reader, it retrieves the data block number parameter from the write command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails, the chip replies with a NACK response; otherwise, it executes the write command step.

[0010] Preferably, the write command includes two steps: Part 1 is a pre-erase operation, and Part 2 is a programming operation.

[0011] Preferably, each section is initialized to the default value of the Mifare One card sector, including the following sub-steps: a) The first 64 bytes of page 1 of a section, at offsets 0 to 63 bytes, are programmed by Flash to the initial default values ​​required by the corresponding sector: Data block 0: 00000000000000000000000000000000 Data block 1: 000000000000000000000000000000000 Data block 2: 000000000000000000000000000000000 ...... Tail block: FFFFFFFFFFFFFF078069FFFFFFFFFFFF; b) Offsets 64 to 67 bytes in page 1: a count value of one word size, programmed to 0 via Flash; c) Offset 68-71 bytes in page 1: This is a one-word occupancy flag, programmed as 0x55AA5AA5 via Flash; d) Offset 72-75 bytes in page 1: This is a checksum of one word size. The checksum is the sum of the offset bytes 0-71 in the current page, or the CRC value, or a checksum obtained by other algorithms. e) Except for the bytes mentioned above, the contents of the other Flash space in this part remain at the default value of 0xff.

[0012] Preferably, the authentication command includes the following sub-steps: 51) Based on the data block number parameter in the authentication command, locate the part that stores the content of the data block; 52) After finding the part, extract the Flash addresses of page 1 and page 2 of that part, and represent them as range_x_page1_addr and range_x_page2_addr; 53) Check the correctness of the data for each page of range_x_page1_addr and range_x_page2_addr respectively; 54) Based on the data correctness check results of each page at address range_x_page1_addr and address range_x_page2_addr, determine whether the latest value of the data block number in the authentication command is stored on page 1 or page 2, which is the latest page; 55) If the above steps find the latest page storage location, allocate 64 bytes of space in the chip memory, copy the 64 bytes of sector data content stored in the Flash of the latest page to the chip memory. This chip memory space is represented as M1CurrSectorContent, and its initial value should be the default value in step S3. 56) After successfully completing the above steps, continue with the standard steps for executing the subsequent Mifare One card authentication commands to carry out the authentication commands.

[0013] Preferably, step S53, checking the correctness of each page of data, includes the following sub-steps: 531) Is the value of the word at offset 68-71 bytes 0x55AA5AA5? 532) Calculate the checksum of the currently selected page and check if the value of the word at offset 72 to 75 bytes is equal to the checksum; 533) If both of the above steps result in "yes", then the data on this page is correct; otherwise, the data on this page is incorrect.

[0014] Preferably, step S54 includes the following sub-steps: 541) If the data correctness checks of pages 1 and 2 are both correct, then it is necessary to read the value of the word at page offset 64 to 67 bytes respectively. The page with the larger value is the latest page, and the other page is set as the next page. 542) If only one page of the data correctness check is correct between page 1 and page 2, then the correct page is set as the latest page, and the other page is set as the next page; 543) If the data correctness checks for pages 1 and 2 both fail, then all data in the sector corresponding to the data block number in the authentication command is corrupted, and the chip sends a NACK response to the card reader.

[0015] Preferably, the write command includes the following sub-steps: 71) After receiving the Part1 write command, erase the next page of the Flash for that Range. The write command consists of two consecutive commands: Part1 write command and Part2 write command. The Part1 write command requires the chip to respond within 5 milliseconds. 72) Upon receiving the Part2 write command, overwrite the 16 bytes of data in the command into the corresponding data block or tail block in M1CurrSectorContent; then retrieve the current page count value and increment it by 1; then retrieve the occupancy flag value 0x55AA5AA5; then calculate the checksum; then perform the programming operation for the next page, writing M1CurrSectorContent, the count value, the occupancy flag value, and the checksum value into the next page in the correct order; after programming, read back to check if the written value is correct, otherwise reply NACK to the card reader. 73) Finally, change the next page to the latest page, and change the previous latest page to the next page.

[0016] Preferably, step S7 is followed by: S8: If the chip receives an increment command from the reader, it retrieves the data block number parameter from the pre-erase increment command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the increment command. The addition command consists of two consecutive commands: Part 1 addition command and Part 2 addition command, specifically including: 81) After receiving the Part1 add value command, map the data block number parameter in the Part1 add value command to the data block address corresponding to M1CurrSectorContent, and copy the data block content in M1CurrSectorContent to Transfer_Buff; 82) After receiving the Part2 add value command, the 4 bytes of data in the Part2 add value command and the data block content in Transfer_Buff are used to generate new value block data according to the requirements of the M1 protocol standard, and the data is overwritten into Transfer_Buff. 83) Erase the next page of that section in Flash space. Preferably, the method further includes the following steps: S9: If the chip receives a decrement command from the reader, it retrieves the data block number parameter from Part 1 of the decrement command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the decrement command. The decrement command consists of two consecutive commands: Part 1 decrement command and Part 2 decrement command, specifically including: 91) Upon receiving the Part1 decrement command, map the data block number parameter to the data block address corresponding to M1CurrSectorContent; and copy the data block content in M1CurrSectorContent to Transfer_Buff; 92) Upon receiving the Part2 decrement command, the 4 bytes of data and the data block content in Transfer_Buff are used to generate a new value block data according to the standard requirements of the M1 protocol, and this data is overwritten into Transfer_Buff. 93) Erase the next page of that section in the Flash space.

[0017] Preferably, the method further includes steps S10 and S11: S10: If the chip receives a recovery command from the card reader, it retrieves the data block number parameter from the Part 1 recovery command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails, the chip replies with a NACK response; otherwise, it executes the recovery command. The recovery command consists of two consecutive commands: Part 1 recovery command and Part 2 recovery command, specifically including: 101) Upon receiving the Part1 recovery command, locate the data block address corresponding to M1CurrSectorContent based on the data block number parameter; and copy the data block content in M1CurrSectorContent to Transfer_Buff; 102) Upon receiving the Part2 recovery command, do nothing according to the M1 standard and restore the contents of Transfer_Buff to be the same as the contents of M1CurrSectorContent; 103) Erase the next page of this section in Flash; S11: If the chip receives a transmission command from the reader, it retrieves the data block number parameter from the transmission command. If this data block number parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the following write command steps: The 16 bytes of data in Transfer_Buff are overwritten into the corresponding data block in M1CurrSectorContent; then the count value of the current page is retrieved and incremented by 1; then the occupancy flag value 0x55AA5AA5 is retrieved; then the checksum value is calculated; then the programming operation for the next page is performed, writing M1CurrSectorContent, the count value, the occupancy flag value, and the checksum value into the next page in the order format; after programming is completed, the written value is read back to check if it is correct, otherwise a NACK is sent to the card reader. Finally, change the next page to the latest page, and change the previous latest page to the next page.

[0018] According to a second aspect of the present invention, a Mifare One card functional chip obtained by the above method is provided.

[0019] Compared with existing technologies, this invention successfully simulates the complete functionality of the Mifare One card on a hardware platform without EEPROM through an innovative Flash storage structure design and a dual-page atomic update mechanism. This method not only simulates the 1KB storage structure and sector management mechanism of the M1 card using Flash devices, but also effectively meets the stringent command response time requirements of the M1 protocol by implementing time-sharing erase and programming operations, dynamic verification, and count value comparison strategies, ensuring the real-time performance and reliability of data transmission. Simultaneously, its dual-page backup and verification mechanism significantly enhances the data's resistance to power loss and storage lifespan, possessing advantages such as small memory footprint, strong compatibility, and high scalability. It provides a low-cost, highly reliable M1 card emulation solution for various embedded devices, mobile terminals, and security chips. Attached Figure Description

[0020] Figure 1 This is a flowchart illustrating a method for implementing Mifare One card functionality based on a Flash device, as described in an embodiment of the present invention. Detailed Implementation

[0021] The technical content of the present invention will now be described in detail with reference to the accompanying drawings and specific embodiments.

[0022] First Embodiment like Figure 1 As shown, the first embodiment of the present invention provides a method for implementing Mifare One card functionality based on a Flash device, which includes at least two phases of operation: an initialization phase and a protocol command processing phase.

[0023] The initialization phase refers to the allocation of a contiguous Flash memory area and the initialization of its content or format during chip manufacturing or initialization. This includes the following steps.

[0024] S1: Allocate a contiguous Flash region (32 pages, 512 bytes per page, total 16KB) Allocate 32 contiguous pages of space in the Flash area. Assuming each page is 512 bytes, the total space occupied is 16KB. The base address is represented by BaseAddr. Then, perform a Flash erase operation on this 16KB area. After erasure, the value of this area will be all 0xFF.

[0025] S2: Divide the Flash area into 16 parts (each part corresponds to one sector of the Mifare One card, for a total of 16 sectors). The allocated 32 pages of space are divided into 16 ranges, each occupying 1KB of contiguous space. Each range is designated from Range0 to Range15, and each range consists of two Flash pages, designated as page 1 and page 2. Therefore, each range from Range0 to Range15 corresponds one-to-one with one of the 16 sectors (Sector0 to Sector15) of the Mifare One card's memory. In other words, one portion of the Flash area corresponds one-to-one with one sector of the Mifare One card.

[0026] S3: Initialize each section (Range) to the default values ​​of the Mifare One card sector, including data blocks, count values, occupancy flags, and check values.

[0027] Because each range uses two Flash pages, a counter value, an occupancy flag (0x55AA5AA5), and a checksum are needed to ensure data atomicity (correctness) and integrity. Furthermore, because default values ​​and checksum structures are preset during initialization, power-loss recovery is supported.

[0028] In step S3, each section of the Flash area is initialized according to the default value of the corresponding sector in the memory of the Mifare One card (new card). The following example illustrates how to format a section (Range1) to the default value required by the new card, using a section (Range1) and its corresponding sector (Sector1) as an example. The specific steps include the following sub-steps.

[0029] a) Program the first 64 bytes (offset addresses 0-63 bytes) of page 1 of Range1 to the initial default values ​​required by the MifareOne card Sector1 via Flash: Data block 0: 00000000000000000000000000000000 Data block 1: 000000000000000000000000000000000 Data block 2: 000000000000000000000000000000000 ...... Tail block: FFFFFFFFFFFFFF078069FFFFFFFFFFFF.

[0030] b) Offsets 64 to 67 bytes in page 1: a count value of one word size, programmed to 0 via Flash; c) Offset 68-71 bytes in page 1: This is a one-word occupancy flag, programmed as 0x55AA5AA5 via Flash; d) Offsets 72-75 in page 1: A checksum of one word size. This checksum is the sum of the words (integers) of offsets 0-71 in the current page (page 1), or a CRC value, or a checksum derived from other algorithms; e) Except for the bytes mentioned above, the contents of the other Flash space in Range1 (including page 2) remain at the default value of 0xff.

[0031] Follow step 3 to complete all 16 parts according to the format and content using Flash programming. Among them, data block 0 of Sector 0 of the Mifare One card is the manufacturer information block, and its content format needs to be initialized as: card UID (occupying 4 or 7 bytes) + BBC checksum of card UID (occupying 1 byte), and the remaining bytes can be defined by the manufacturer.

[0032] The protocol command processing phase includes the following steps.

[0033] S4: After power-on, enter the receiving state, wait for the card reader command, and then proceed to one of steps S5 to S11.

[0034] After the chip is powered on, it turns on the radio frequency and enters the receiving state, waiting to receive Mifare commands (authentication command, read command, write command, increment / decrement / restore command or transmission command) from the card reader.

[0035] Authentication command: Locate the corresponding section (Range) based on the block number, check the data correctness, determine page 1 and page 2 of the section, and load the data of the sector corresponding to the section into memory (M1CurrSectorContent). Read command: Reads data blocks or tail blocks from memory and responds to the card reader; Write command: Executed in two steps. The first step is to erase the next page; the second step is to write the new data into memory, update the counter value and check value, program to the next page, and switch to the latest page.

[0036] Add / decrease / restore commands: Operate on value blocks of data in memory and temporarily store them in the transfer buffer (Transfer_Buff).

[0037] Transfer command: Writes buffer data to memory, updating the contents of the Flash space (similar to the second step of the write command).

[0038] S5: If the chip receives an authentication command from the reader, it checks the magic word flag (bytes 68-71 = 0x55AA5AA5) and dynamic checksum (bytes 72-75) of each page. It performs a two-condition verification of data validity. When both pages are valid, the page with the larger count value is selected as the latest page (to implement version control). When only one page is valid, the correct page is directly selected as the latest page. If both pages fail, an error is reported (NACK response). Typically, the authentication command carries the parameter of the authentication data block number. The block number range for Mifare One cards is 0 to 63. For example, data block 0 in sector 1 is actually data block 4 of the Mifare One card.

[0039] Because the chip storage uses Flash emulation, executing the Mifare protocol authentication command includes the following steps: 51) Based on the data block number parameter in the authentication command, find the part that stores the content of the data block (for example, part x, denoted as "Rangex").

[0040] The corresponding part is found by taking the remainder of the data block number parameter. For example, if the data block is 5, dividing 5 by 4 will result in a remainder of 1, indicating that data block 5 is stored in the Range1 area of ​​the Flash space.

[0041] 52) After finding the part, extract the Flash addresses of page 1 and page 2 of that part, and represent them as range_x_page1_addr and range_x_page2_addr.

[0042] 53) Check the correctness of the data for each page of range_x_page1_addr and range_x_page2_addr respectively. The steps for checking the correctness of the data for each page are as follows: 531) Is the value of the word at offset 68-71 bytes 0x55AA5AA5? 532) Calculate the checksum of the currently selected page and check if the value of the word at offset 72 to 75 bytes is equal to the checksum; 533) If both of the above steps result in "yes", then the data on this page is correct; otherwise, the data on this page is incorrect.

[0043] 54) Based on the data correctness check results of each page at the range_x_page1_addr and range_x_page2_addr addresses, determine whether the latest value of the data block number in the authentication command is stored on page 1 or page 2, which is the latest page.

[0044] 541) If the data correctness checks of pages 1 and 2 are both correct, then it is necessary to read the value of the word at page offset 64 to 67 bytes respectively. The page with the larger value is the latest page, and the other page is set as the next page. 542) If only one page of the data correctness check is correct between page 1 and page 2, then the correct page is set as the latest page, and the other page is set as the next page; 543) If the data correctness checks for pages 1 and 2 both fail, then all data in the sector corresponding to the data block number in the authentication command is corrupted, and the chip sends a negative response (NACK) to the card reader.

[0045] To restore the functionality of this sector, the chip manufacturing or initialization process must be performed, but data corruption is irreversible.

[0046] 55) If the above steps find the latest page storage location, allocate 64 bytes of space in the chip memory, copy the 64 bytes of sector data content stored in the Flash of the latest page to the chip memory. This chip memory space is denoted as M1CurrSectorContent, and its initial value should be the default value in step S3.

[0047] Subsequent read, write, increment, decrement, restore, and transfer commands will all use this memory space; in addition, 16 bytes of space are allocated in the chip memory as a transfer buffer, denoted as Transfer_Buff, and subsequent increment, decrement, restore, and transfer commands will all use this memory space.

[0048] 56) After successfully completing the above steps, continue with the standard steps for executing the subsequent Mifare One card authentication commands to carry out the authentication commands.

[0049] Since this is standard procedure, it will not be explained in detail here.

[0050] S6: If the chip receives a read command from the card reader, it retrieves the data block number parameter from the read command and determines whether the data block number parameter in the read command and the data block number parameter in the authentication command are in the same sector, or whether the authentication command ultimately failed. If they are not in the same sector or the execution failed, the chip replies with a NACK response to the card reader; otherwise, it executes the read command steps: The read command process includes the following sub-steps: If the read command reads a data block, the data block number parameter in the read command is mapped to the relative data block number in M1CurrSectorContent by taking the modulo operation (%4), so that the content of that data block is read and responded to the card reader.

[0051] In this embodiment, the data block number is equal to the remainder (%4) of the data block number parameter in the read command, thereby locating the specific data block content within the currently authenticated sector. Then, the chip sends the data block content to the card reader.

[0052] If the read command reads the tail block, it reads the tail block data in M1CurrSectorContent, uses the Mifare One card standard interpretation permissions based on the data, generates the tail block shadow data content (16 bytes in size unchanged), and sends the shadow content to the card reader.

[0053] S7: If the chip receives a write command from the reader that includes two steps, it retrieves the data block number parameter from Part 1 of the write command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails, the chip replies with a NACK response; otherwise, it executes the write command steps. The command writing process includes the following sub-steps: The write command consists of two consecutive commands: Part 1 and Part 2. Part 1 requires a chip response timeout of less than 5 milliseconds, and Part 2 requires a response time of less than 10 milliseconds. This is not a concern when using EEPROM, but special attention is needed when using Flash storage. Because there are many types of Flash devices, the erase and programming times vary, typically ranging from a few milliseconds to tens of milliseconds. This invention recommends selecting a Flash device with an erase time of less than 10 ms plus a programming time of less than 5 ms and a programming time of less than 10 ms.

[0054] 71) After receiving the Part1 write command, erase the next page of the Flash Range.

[0055] 72) Upon receiving the Part2 write command, overwrite the 16 bytes of data in the command into the corresponding data block or tail block in M1CurrSectorContent; then retrieve the current page count value and increment it by 1; then retrieve the occupancy flag value 0x55AA5AA5; then calculate the checksum; then perform the programming operation for the next page, writing M1CurrSectorContent, the count value, the occupancy flag value, and the checksum value into the next page in the order format; after programming is completed, read back to check if the written value is correct, otherwise reply NACK to the card reader.

[0056] 73) Finally, change the next page to the latest page, and change the previous latest page to the next page.

[0057] In this way, even if the chip loses power and then gains power again, it can still identify the correct latest page and next page through step S2. At the same time, if the chip loses power during the Flash erase and programming process, or if the Flash lifespan expires, causing the next page programming to fail, step S2 can still identify and select the current page, and still select the next page that failed to be programmed as the next page.

[0058] S8: If the chip receives a value-adding command from the reader, it retrieves the data block number parameter from the pre-erase (Part 1) value-adding command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the following write command steps.

[0059] In this invention, because the write command is split into two steps (Part 1 is pre-erasure, and Part 2 is programming), the addition command consists of two consecutive commands: Part 1 addition command and Part 2 addition command.

[0060] 81) After receiving the Part1 add value command, map the data block number parameter in the Part1 add value command to the data block address corresponding to M1CurrSectorContent, and copy the data block content in M1CurrSectorContent to Transfer_Buff.

[0061] The mapping formula is: M1CurrSectorContent's data block number = data block number parameter % 4.

[0062] 82) Upon receiving the Part2 add value command, the 4 bytes of data in the Part2 add value command and the data block content in Transfer_Buff are used to generate a new value block data (16 bytes) according to the requirements of the M1 protocol standard, and this data is overwritten into Transfer_Buff.

[0063] 83) Erase the next page of the range in the Flash space.

[0064] S9: If the chip receives a decrement command from the reader, it retrieves the data block number parameter from Part 1 decrement command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the following write command steps.

[0065] Here, the decrement command consists of two consecutive commands: Part 1 decrement command and Part 2 decrement command.

[0066] 91) Upon receiving the Part1 decrement command, map the data block number parameter to the corresponding data block address of M1CurrSectorContent (data block number of M1CurrSectorContent = data block number parameter % 4); and copy the data block content in M1CurrSectorContent to Transfer_Buff; 92) Upon receiving the Part2 decrement command, the 4 bytes of data and the data block content in Transfer_Buff are combined to generate a new value block data (16 bytes) according to the standard requirements of the M1 protocol, and this data is overwritten into Transfer_Buff; 93) Erase the next page of the section (Range) in Flash space.

[0067] S10: If the card reader command received by the chip is a recovery command, then obtain the data block number parameter in the Part 1 recovery command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails, then the chip replies with a NACK response; otherwise, execute the following write command steps.

[0068] The recovery command consists of two consecutive commands: Part 1 recovery command and Part 2 recovery command.

[0069] 101) After receiving the Part1 recovery command, find the data block address corresponding to M1CurrSectorContent according to the data block number parameter (the formula is M1CurrSectorContent data block number = data block number parameter % 4); and copy the data block content in M1CurrSectorContent to Transfer_Buff; 102) Upon receiving the Part2 recovery command, do nothing according to the M1 standard. The purpose of this command is to restore the contents of Transfer_Buff to be the same as the contents of M1CurrSectorContent. 103) Erase the next page of the Flash for this range.

[0070] S11: If the chip receives a transmission command from the reader, it retrieves the data block number parameter from the transmission command. If the data block number parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the following write command steps.

[0071] Typically, command transmission requires a response time of less than 10 milliseconds. This time requirement is not an issue for EEPROM, but it is crucial for Flash storage. Because there are many types of Flash devices, the erase and programming times vary, usually ranging from a few milliseconds to tens of milliseconds. The Flash device of this invention satisfies the following conditions: the sum of the time to erase one page and the time to program 76 bytes is less than 10 ms, or the time to erase one page is less than 5 ms and the time to program 76 bytes is less than 10 ms.

[0072] Because the transfer command is always used in conjunction with the increment, decrement, and restore instructions, the work of erasing the next page of the range in the Flash space is already completed when the transfer command is executed.

[0073] In this step, the steps for executing the write command are: The 16 bytes of data in Transfer_Buff are overwritten into the corresponding data block in M1CurrSectorContent; then the count value of the current page is retrieved and incremented by 1; then the occupancy flag value 0x55AA5AA5 is retrieved; then the checksum value is calculated; then the programming operation for the next page is performed, writing M1CurrSectorContent, the count value, the occupancy flag value, and the checksum value into the next page in the order format; after programming is completed, the written value is read back to check if it is correct, otherwise a NACK is sent to the card reader. Finally, change the next page to the latest page, and change the previous latest page to the next page.

[0074] Even if the chip loses power and then gains power again, step 5 can still identify the correct latest page and next page. At the same time, if the chip loses power during Flash erasure and programming, or if the Flash lifespan expires, causing the next page programming to fail, step 5 can still identify and select the latest page, and still select the next page that failed to be programmed as the next page.

[0075] It should be noted that in the above steps, the time-consuming Flash erasure and programming operations are broken down into different command stages (such as Part 1 for erasure and Part 2 for programming in the write command), and a Flash device with suitable performance is selected (erasure + programming time < 10ms) to ensure real-time performance and meet the response time requirements of the M1 protocol (Part 1 response < 5ms, Part 2 response < 10ms).

[0076] Second Embodiment The second embodiment of the present invention provides another method for implementing Mifare One card functionality based on Flash devices, which can optimize the storage structure according to Flash performance and provides scalability that allows for flexible adjustment of the storage structure. This embodiment differs from the first embodiment in the following ways, where the same parts will not be repeated: If the Flash performance can achieve a sum of less than 10ms between the time to erase one page and the time to program 76 bytes, then the Flash erasure steps in the first embodiment can all be moved to be performed before the programming operation. That is, the order of the Flash pre-erasure (Part 1) and programming (Part 2) operations can be interchanged.

[0077] If the Flash programming performance can meet the following requirements: the time to erase a page is less than 5ms and the time to program (64+64+12=140) bytes is less than 10ms, then the number of Flash pages allocated can be reduced from 32 pages to 16 pages, and each page can store data of 2 sectors, so as to save Flash space.

[0078] If the Flash programming performance meets the following requirements: erasing a page takes less than 5ms and programming (64×i+12) bytes takes less than 10ms, then the number of Flash pages can be reduced to 32 / i. In the extreme case, if one Flash page can store 1K of M1 space, then only 2 Flash pages are needed. It should be noted that in this case, the M1CurrSectorContent space allocated to the chip also needs to be 64×i, where i represents the number of Mifare One card sectors that can be completely stored in each Flash page.

[0079] In summary, the method for implementing Mifare One card functionality based on Flash devices provided in the second embodiment of the present invention can effectively reduce the amount of Flash space occupied.

[0080] Third Embodiment Based on the above-described method for implementing Mifare One card functionality using Flash devices, the third embodiment of the present invention further provides a corresponding Mifare One card functionality chip, which is implemented based on the method provided in the foregoing embodiments.

[0081] In summary, this invention has the following technical features: 1) The design using a Range structure, checksum, and occupancy flag for initialization provides a new storage format and offers scalability for flexible adjustment of the storage structure; 2) By splitting the write command into two steps (pre-erase and programming), the contradiction between Flash performance and protocol real-time performance is resolved; 3) The adoption of a latest page / next page dual-page switching mechanism and verification strategy achieves atomic updates and fault tolerance. Therefore, this invention breaks through the limitations of traditional direct Flash storage and solves three key problems in EEPROM missing scenarios: real-time response (preloading during the authentication phase), data reliability (verification using three elements: count value, magic word flag, and dynamic checksum), and storage lifetime (alternating dual-page updates).

[0082] It should be noted that the above embodiments are merely illustrative examples, and the technical solutions of each embodiment can be combined, and the order of each step can be changed, all of which are within the protection scope of this invention.

[0083] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0084] The method and chip for implementing Mifare One card functionality based on Flash devices provided by this invention have been described in detail above. Any obvious modifications made by those skilled in the art without departing from the essence of this invention will constitute an infringement of the patent rights of this invention and will incur corresponding legal liability.

Claims

1. A method for implementing Mifare One card functionality based on a Flash device, characterized in that... Includes the following steps: S1: Allocate 16 or 32 consecutive pages of space in the Flash area; S2: Divide the Flash area into 16 parts, each part corresponding to 1 sector of the Mifare One card, and each part consists of 2 Flash pages, referred to as page 1 and page 2 respectively; S3: Initialize each section to the default values ​​of the Mifare One card sector, including the data block value, count value, occupancy flag, and check value; S4: After power-on, it enters the receiving state and waits for the card reader command; S5: If the chip receives an authentication command from the reader, check the magic letter flag and dynamic check value of each page, and verify the data validity under two conditions: when both pages are valid, select the page with the larger count value as the latest page; when only one page is valid, directly select the correct page as the latest page; if both pages are invalid, report an error. S6: If the chip receives a read command from the card reader, it retrieves the data block number parameter from the read command and determines whether the data block number parameter in the read command and the data block number parameter in the authentication command are in the same sector, or whether the authentication command ultimately failed. If they are not in the same sector or the execution fails, the chip replies with a NACK response to the card reader; otherwise, it executes the read command steps. S7: If the chip receives a write command from the reader, it retrieves the data block number parameter from the write command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails, the chip replies with a NACK response; otherwise, it executes the write command step.

2. The method for implementing Mifare One card functionality based on a Flash device as described in claim 1, characterized in that... Initialize each section to the default values ​​for Mifare One card sectors, including the following sub-steps: a) The first 64 bytes of page 1 of a section, at offsets 0 to 63 bytes, are programmed by Flash to the initial default values ​​required by the corresponding sector: Data block 0: 00000000000000000000000000000000 Data block 1: 000000000000000000000000000000000 Data block 2: 000000000000000000000000000000000 ...... Tail block: FFFFFFFFFFFFFF078069FFFFFFFFFFFF; b) Offsets 64 to 67 bytes in page 1: a count value of one word size, programmed to 0 via Flash; c) Offset 68-71 bytes in page 1: This is a one-word occupancy flag, programmed as 0x55AA5AA5 via Flash; d) Offsets 72-75 in page 1: This is a checksum of one word size, which is the sum of the values ​​of offsets 0-71 in the current page. e) Except for the bytes mentioned above, the contents of the other Flash space in this part remain at the default value of 0xff.

3. The method for implementing Mifare One card functionality based on a Flash device as described in claim 2, characterized in that... The authentication command includes the following sub-steps: 51) Based on the data block number parameter in the authentication command, locate the part that stores the content of the data block; 52) After finding the part, extract the Flash addresses of page 1 and page 2 of that part, and represent them as range_x_page1_addr and range_x_page2_addr; 53) Check the correctness of the data for each page of range_x_page1_addr and range_x_page2_addr respectively; 54) Based on the data correctness check results of each page at address range_x_page1_addr and address range_x_page2_addr, determine whether the latest value of the data block number in the authentication command is stored on page 1 or page 2, which is the latest page; 55) If the above steps find the latest page storage location, allocate 64 bytes of space in the chip memory, copy the 64 bytes of sector data content stored in the Flash of the latest page to the chip memory. This chip memory space is represented as M1CurrSectorContent, and its initial value should be the default value in step S3. 56) After successfully completing the above steps, continue with the standard steps for executing the subsequent Mifare One card authentication commands to carry out the authentication commands.

4. The method for implementing Mifare One card functionality based on a Flash device as described in claim 3, characterized in that... In step S53, checking the correctness of each page of data includes the following sub-steps: 531) Is the value of the word at offset 68-71 bytes 0x55AA5AA5? 532) Calculate the checksum of the currently selected page and check if the value of the word at offset 72 to 75 bytes is equal to the checksum; 533) If both of the above steps result in "yes", then the data on this page is correct; otherwise, the data on this page is incorrect.

5. The method for implementing Mifare One card functionality based on a Flash device as described in claim 4, characterized in that... Step S54 includes the following sub-steps: 541) If the data correctness checks of pages 1 and 2 are both correct, then it is necessary to read the value of the word at page offset 64 to 67 bytes respectively. The page with the larger value is the latest page, and the other page is set as the next page. 542) If only one page of the data correctness check is correct between page 1 and page 2, then the correct page is set as the latest page, and the other page is set as the next page; 543) If the data correctness checks for pages 1 and 2 both fail, then all data in the sector corresponding to the data block number in the authentication command is corrupted, and the chip sends a NACK response to the card reader.

6. The method for implementing Mifare One card functionality based on a Flash device as described in any one of claims 1 to 5, characterized in that... The process after step S7 also includes: S8: If the chip receives a value-adding command from the reader, it retrieves the data block number parameter from the pre-erase value-adding command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the value-adding command. The addition command consists of two consecutive commands: Part 1 addition command and Part 2 addition command, specifically including: 81) After receiving the Part1 add value command, map the data block number parameter in the Part1 add value command to the data block address corresponding to M1CurrSectorContent, and copy the data block content in M1CurrSectorContent to Transfer_Buff; 82) After receiving the Part2 add value command, the 4 bytes of data in the Part2 add value command and the data block content in Transfer_Buff are used to generate new value block data according to the requirements of the M1 protocol standard, and the data is overwritten into Transfer_Buff. 83) Erase the next page of that section in the Flash space.

7. The method for implementing Mifare One card functionality based on a Flash device as described in claim 6, characterized in that... It also includes the following steps: S9: If the chip receives a decrement command from the reader, it obtains the data block number parameter from Part 1 decrement command. If this parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader. Otherwise, execute the decrement command; The decrement command consists of two consecutive commands: Part 1 decrement command and Part 2 decrement command; specifically, it includes: 91) Upon receiving the Part1 decrement command, map the data block number parameter to the data block address corresponding to M1CurrSectorContent; and copy the data block content in M1CurrSectorContent to Transfer_Buff; 92) After receiving the Part2 decrement command, generate a new value block data by taking 4 bytes of data and the data block content in Transfer_Buff according to the standard requirements of the M1 protocol, and overwrite the data into Transfer_Buff. 93) Erase the next page of that section in the Flash space.

8. The method for implementing Mifare One card functionality based on a Flash device as described in claim 7, characterized in that... It also includes the following steps S10 and S11: S10: If the card reader command received by the chip is a recovery command, then obtain the data block number parameter in Part 1 recovery command. If this parameter is not in the same sector as the data block number parameter in the Mifare authentication command in step S2, or if the authentication command ultimately fails to execute, then the chip replies with a NACK response. Otherwise, execute the recovery command: The recovery command consists of two consecutive commands: Part 1 recovery command and Part 2 recovery command, specifically including: 101) Upon receiving the Part1 recovery command, locate the data block address corresponding to M1CurrSectorContent based on the data block number parameter; and copy the data block content in M1CurrSectorContent to Transfer_Buff; 102) Upon receiving the Part2 recovery command, do nothing according to the M1 standard and restore the contents of Transfer_Buff to be the same as the contents of M1CurrSectorContent; 103) Erase the next page of this section in Flash; S11: If the chip receives a transmission command from the reader, it retrieves the data block number parameter from the transmission command. If this data block number parameter is not in the same sector as the data block number parameter in the authentication command, or if the authentication command ultimately fails, the chip replies with a NACK response to the reader; otherwise, it executes the following steps: The 16 bytes of data in Transfer_Buff are overwritten into the corresponding data block in M1CurrSectorContent; then the count value of the current page is retrieved and incremented by 1; then the occupancy flag value 0x55AA5AA5 is retrieved; then the check value is calculated; then the programming operation for the next page is performed, writing M1CurrSectorContent, the count value, the occupancy flag value, and the check value into the next page in the order format. After programming is complete, read back to check if the written value is correct; otherwise, send a NACK response to the card reader. Finally, change the next page to the latest page, and change the previous latest page to the next page.

Images